diff --git a/changelog.html b/changelog.html
index 9f770ca9c85e1353651bb3624cefb4be9fcff763..7df33fa4419f5fb3ef4c98eb2b998bad25b05763 100644
--- a/changelog.html
+++ b/changelog.html
@@ -65,6 +65,9 @@ Upcoming changes</a>
     (<a href="https://issues.jenkins-ci.org/browse/JENKINS-12529">issue 12529</a>)  
   <li class=ref>
     Matrix job now allows delete whole matrix, including sub-jobs.
+  <li class=bug>
+    Fixed a bug in LDAP default root DN inference.
+    (<a href="https://issues.jenkins-ci.org/browse/JENKINS-8152">issue 8152</a>)
 </ul>
 </div><!--=TRUNK-END=-->
 
diff --git a/core/src/main/java/hudson/security/LDAPSecurityRealm.java b/core/src/main/java/hudson/security/LDAPSecurityRealm.java
index fbe5188b79ad0185a1821000357a4e1ba9aff821..37f94ac1b1d6d4eca30fc4ce4d7aed30abdbe6e9 100644
--- a/core/src/main/java/hudson/security/LDAPSecurityRealm.java
+++ b/core/src/main/java/hudson/security/LDAPSecurityRealm.java
@@ -325,8 +325,8 @@ public class LDAPSecurityRealm extends AbstractPasswordBasedSecurityRealm {
             DirContext ctx = new InitialDirContext(props);
             Attributes atts = ctx.getAttributes("");
             Attribute a = atts.get("defaultNamingContext");
-            if(a!=null) // this entry is available on Active Directory. See http://msdn2.microsoft.com/en-us/library/ms684291(VS.85).aspx
-                return a.toString();
+            if(a!=null && a.get()!=null) // this entry is available on Active Directory. See http://msdn2.microsoft.com/en-us/library/ms684291(VS.85).aspx
+                return a.get().toString();
             
             a = atts.get("namingcontexts");
             if(a==null) {